MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0c55cd5be063f194a58e7357c5b08f3e3b2700eb5d8e89cf92120dbc120a0064. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

ArkeiStealer

Vendor detections: 9

Intelligence 9 IOCs YARA 8 File information Comments

SHA256 hash:	0c55cd5be063f194a58e7357c5b08f3e3b2700eb5d8e89cf92120dbc120a0064
SHA3-384 hash:	81a59fc2ae44870814c775795ee1431c3686e22b60736fec159f4dd78435bffff58f0332752febc20cd288e60d0cafb6
SHA1 hash:	c44136e3a9640ed7771027637c6de608a8802e50
MD5 hash:	7b29a109f8cce2795c4eaa2cccc46ff3
humanhash:	cold-snake-illinois-fourteen
File name:	7b29a109f8cce2795c4eaa2cccc46ff3.exe
Download:	download sample
Signature	ArkeiStealer Create hunting rule
File size:	2'912'256 bytes
First seen:	2021-05-25 07:06:47 UTC
Last seen:	2021-05-25 08:06:16 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	425f1b6477ecc31f517424188db5c5dc (2 x ArkeiStealer)
ssdeep	49152:2WHnCA+dTLBQyw+i4fpZaZtbGhH/3pU8dkQp/FvoDk6ywOi47Lf9hH/3pU8KkQ:2W65Qy24fpZaLJ8dkQiVyi4768Kk
Threatray	2'274 similar samples on MalwareBazaar
TLSH	F7D523A1335097B8F4354172AE850A83EE606D21DE8E332F36C2772F497F5177A4B64A
Reporter	abuse_ch
Tags:	ArkeiStealer exe

Intelligence

File Origin

# of uploads :

# of downloads :

112

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

x86_x64_setup.exe

Verdict:

Malicious activity

Analysis date:

2021-05-25 00:00:22 UTC

Tags:

evasion opendir loader trojan rat redline stealer vidar phishing autoit

Link:

https://app.any.run/tasks/296c08ca-7ec8-4796-847b-62d9a15571b3

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Vidar

Link:

https://www.capesandbox.com/analysis/161707/

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for analyzing tools

Searching for the window

DNS request

Sending a custom TCP request

Sending a UDP request

Connection attempt

Sending an HTTP GET request

Creating a file

Deleting a recently created file

Replacing files

Reading critical registry keys

Creating a window

Delayed writing of the file

Running batch commands

Creating a process with a hidden window

Using the Windows Management Instrumentation requests

Launching a process

Stealing user critical data

Launching a tool to kill processes

Forced shutdown of a browser

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Result

Threat name:

Vidar

Detection:

malicious

Classification:

phis.troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/791498

Signature

Detected unpacking (changes PE section rights)

Found malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Found Tor onion address

Hides threads from debuggers

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Query firmware table information (likely to detect VMs)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Crypto Currency Wallets

Tries to steal Instant Messenger accounts or passwords

Yara detected Vidar stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/0c55cd5be063f194a58e7357c5b08f3e3b2700eb5d8e89cf92120dbc120a0064/

Threat name:

Win32.Trojan.Chapak

Status:

Malicious

First seen:

2021-05-24 08:56:03 UTC

AV detection:

15 of 29 (51.72%)

Threat level:

5/5

Verdict:

unknown

ArkeiStealer

0f0eb4a8a538f339214f86a8b084d685a4fb51d54f258f5718393003ab1ff35b

ArkeiStealer

6e29b950d675a5cf30bfd81326279d3310b1c26658b9d09091e6d8871354320b

ArkeiStealer

6ef31a13d71d059d6e007fb2305c8e2d7615c3d468c9f2f4e023b45490b50787

ArkeiStealer

7f588ecbff9405b87fa5b809b52d0b667f19a09e47bafc2cf1f5f9d5f19f16c1

ArkeiStealer

8b1c960881fc789460b5b274abd43baddb1c92e1a942d3a1080a4adb1f545e50

ArkeiStealer

a8fb61732f9696d24e02dda47d2f12abe0d8968e130f05d2381bb7b5a93f3ec0

ArkeiStealer

a9b0a14beac57ba149a978c8f0996a4f4e70e003b80c67e631947c9dc3590154

ArkeiStealer

cc4c6be7a609aaaabf82ae1cd164c567ff7f7cc1ebdb59175d0ae1ecbac74b5c

ArkeiStealer

d98fd8189273e4f4fcbb8b1d5b32459b5d7adcd6eaff9efef0c32ace0fdfab0e

ArkeiStealer

+ 2'264 additional samples on MalwareBazaar

Result

Malware family:

vidar

Score:

10/10

Tags:

family:vidar discovery evasion spyware stealer trojan

Link:

https://tria.ge/reports/210525-gjhab8sswj/

Behaviour

Checks processor information in registry

Delays execution with timeout.exe

Kills process with taskkill

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Program crash

Suspicious use of NtSetInformationThreadHideFromDebugger

Accesses 2FA software files, possible credential harvesting

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Checks whether UAC is enabled

Checks BIOS information in registry

Loads dropped DLL

Reads local data of messenger clients

Reads user/profile data of web browsers

Downloads MZ/PE file

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Vidar

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

0.84

Link:

https://yomi.yoroi.company/submissions/0c55cd5be063f194a58e7357c5b08f3e3b2700eb5d8e89cf92120dbc120a0064

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	INDICATOR_EXE_Packed_MPress Create hunting rule
Author:	ditekSHen
Description:	Detects executables built or packed with MPress PE compressor

Rule name:	INDICATOR_EXE_Packed_VMProtect Create hunting rule
Author:	ditekSHen
Description:	Detects executables packed with VMProtect.

Rule name:	INDICATOR_SUSPICIOUS_EXE_References_CryptoWallets Create hunting rule
Author:	ditekSHen
Description:	Detects executables referencing many cryptocurrency mining wallets or apps. Observed in information stealers

Rule name:	INDICATOR_SUSPICOIUS_WindDefender_AntiEmaulation Create hunting rule
Author:	ditekSHen
Description:	Detects executables containing potential Windows Defender anti-emulation checks

Rule name:	MALWARE_Win_Vidar Create hunting rule
Author:	ditekSHen
Description:	Detects Vidar / ArkeiStealer

Rule name:	suspicious_packer_section Create hunting rule
Author:	@j0sm1
Description:	The packer/protector section names/keywords
Reference:	http://www.hexacorn.com/blog/2012/10/14/random-stats-from-1-2m-samples-pe-section-names/

Rule name:	Vidar Create hunting rule
Author:	kevoreilly
Description:	Vidar Payload

Rule name:	with_sqlite Create hunting rule
Author:	Julian J. Gonzalez <info@seguridadparatodos.es>
Description:	Rule to detect the presence of SQLite data in raw image
Reference:	http://www.st2labs.com